| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chromeos/network/onc/onc_certificate_importer.h" | 5 #include "chromeos/network/onc/onc_certificate_importer.h" |
| 6 | 6 |
| 7 #include <cert.h> | 7 #include <cert.h> |
| 8 #include <keyhi.h> | 8 #include <keyhi.h> |
| 9 #include <pk11pub.h> | 9 #include <pk11pub.h> |
| 10 | 10 |
| 11 #include "base/base64.h" | 11 #include "base/base64.h" |
| 12 #include "base/logging.h" | 12 #include "base/logging.h" |
| 13 #include "base/values.h" | 13 #include "base/values.h" |
| 14 #include "chromeos/network/network_event_log.h" | 14 #include "chromeos/network/network_event_log.h" |
| 15 #include "chromeos/network/onc/onc_constants.h" | 15 #include "chromeos/network/onc/onc_constants.h" |
| 16 #include "net/base/crypto_module.h" | 16 #include "net/base/crypto_module.h" |
| 17 #include "net/base/net_errors.h" | 17 #include "net/base/net_errors.h" |
| 18 #include "net/cert/nss_cert_database.h" | 18 #include "net/cert/nss_cert_database.h" |
| 19 #include "net/cert/pem_tokenizer.h" | 19 #include "net/cert/pem_tokenizer.h" |
| 20 #include "net/cert/x509_certificate.h" | 20 #include "net/cert/x509_certificate.h" |
| 21 | 21 |
| 22 #define ONC_LOG_WARNING(message) NET_LOG_WARNING("ONC", message) | 22 #define ONC_LOG_WARNING(message) \ |
| 23 #define ONC_LOG_ERROR(message) NET_LOG_ERROR("ONC", message) | 23 NET_LOG_DEBUG("ONC Certificate Import Warning", message) |
| 24 #define ONC_LOG_ERROR(message) \ |
| 25 NET_LOG_ERROR("ONC Certificate Import Error", message) |
| 24 | 26 |
| 25 namespace { | 27 namespace { |
| 26 | 28 |
| 27 // The PEM block header used for DER certificates | 29 // The PEM block header used for DER certificates |
| 28 const char kCertificateHeader[] = "CERTIFICATE"; | 30 const char kCertificateHeader[] = "CERTIFICATE"; |
| 29 // This is an older PEM marker for DER certificates. | 31 // This is an older PEM marker for DER certificates. |
| 30 const char kX509CertificateHeader[] = "X509 CERTIFICATE"; | 32 const char kX509CertificateHeader[] = "X509 CERTIFICATE"; |
| 31 | 33 |
| 32 } // namespace | 34 } // namespace |
| 33 | 35 |
| (...skipping 256 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 290 net::NSSCertDatabase::TrustBits trust = import_with_ssl_trust ? | 292 net::NSSCertDatabase::TrustBits trust = import_with_ssl_trust ? |
| 291 net::NSSCertDatabase::TRUSTED_SSL : | 293 net::NSSCertDatabase::TRUSTED_SSL : |
| 292 net::NSSCertDatabase::TRUST_DEFAULT; | 294 net::NSSCertDatabase::TRUST_DEFAULT; |
| 293 if (cert_type == certificate::kServer) { | 295 if (cert_type == certificate::kServer) { |
| 294 success = cert_database->ImportServerCert(cert_list, trust, &failures); | 296 success = cert_database->ImportServerCert(cert_list, trust, &failures); |
| 295 } else { // Authority cert | 297 } else { // Authority cert |
| 296 success = cert_database->ImportCACerts(cert_list, trust, &failures); | 298 success = cert_database->ImportCACerts(cert_list, trust, &failures); |
| 297 } | 299 } |
| 298 | 300 |
| 299 if (!failures.empty()) { | 301 if (!failures.empty()) { |
| 300 ONC_LOG_ERROR("Error (" + net::ErrorToString(failures[0].net_error) + | 302 ONC_LOG_ERROR(base::StringPrintf("Error ( %s ) importing %s certificate", |
| 301 ") importing " + cert_type + " certificate"); | 303 net::ErrorToString(failures[0].net_error), |
| 304 cert_type.c_str())); |
| 302 return false; | 305 return false; |
| 303 } | 306 } |
| 304 if (!success) { | 307 if (!success) { |
| 305 ONC_LOG_ERROR("Unknown error importing " + cert_type + " certificate."); | 308 ONC_LOG_ERROR("Unknown error importing " + cert_type + " certificate."); |
| 306 return false; | 309 return false; |
| 307 } | 310 } |
| 308 | 311 |
| 309 if (web_trust_flag && onc_trusted_certificates) | 312 if (web_trust_flag && onc_trusted_certificates) |
| 310 onc_trusted_certificates->push_back(x509_cert); | 313 onc_trusted_certificates->push_back(x509_cert); |
| 311 | 314 |
| (...skipping 19 matching lines...) Expand all Loading... |
| 331 } | 334 } |
| 332 | 335 |
| 333 // Since this has a private key, always use the private module. | 336 // Since this has a private key, always use the private module. |
| 334 net::NSSCertDatabase* cert_database = net::NSSCertDatabase::GetInstance(); | 337 net::NSSCertDatabase* cert_database = net::NSSCertDatabase::GetInstance(); |
| 335 scoped_refptr<net::CryptoModule> module(cert_database->GetPrivateModule()); | 338 scoped_refptr<net::CryptoModule> module(cert_database->GetPrivateModule()); |
| 336 net::CertificateList imported_certs; | 339 net::CertificateList imported_certs; |
| 337 | 340 |
| 338 int import_result = cert_database->ImportFromPKCS12( | 341 int import_result = cert_database->ImportFromPKCS12( |
| 339 module.get(), decoded_pkcs12, string16(), false, &imported_certs); | 342 module.get(), decoded_pkcs12, string16(), false, &imported_certs); |
| 340 if (import_result != net::OK) { | 343 if (import_result != net::OK) { |
| 341 ONC_LOG_ERROR("Unable to import client certificate (error " + | 344 ONC_LOG_ERROR( |
| 342 net::ErrorToString(import_result) + ")."); | 345 base::StringPrintf("Unable to import client certificate (error %s)", |
| 346 net::ErrorToString(import_result))); |
| 343 return false; | 347 return false; |
| 344 } | 348 } |
| 345 | 349 |
| 346 if (imported_certs.size() == 0) { | 350 if (imported_certs.size() == 0) { |
| 347 ONC_LOG_WARNING("PKCS12 data contains no importable certificates."); | 351 ONC_LOG_WARNING("PKCS12 data contains no importable certificates."); |
| 348 return true; | 352 return true; |
| 349 } | 353 } |
| 350 | 354 |
| 351 if (imported_certs.size() != 1) { | 355 if (imported_certs.size() != 1) { |
| 352 ONC_LOG_WARNING("ONC File: PKCS12 data contains more than one certificate. " | 356 ONC_LOG_WARNING("ONC File: PKCS12 data contains more than one certificate. " |
| (...skipping 12 matching lines...) Expand all Loading... |
| 365 PK11_SetPrivateKeyNickname(private_key, const_cast<char*>(guid.c_str())); | 369 PK11_SetPrivateKeyNickname(private_key, const_cast<char*>(guid.c_str())); |
| 366 SECKEY_DestroyPrivateKey(private_key); | 370 SECKEY_DestroyPrivateKey(private_key); |
| 367 } else { | 371 } else { |
| 368 ONC_LOG_WARNING("Unable to find private key for certificate."); | 372 ONC_LOG_WARNING("Unable to find private key for certificate."); |
| 369 } | 373 } |
| 370 return true; | 374 return true; |
| 371 } | 375 } |
| 372 | 376 |
| 373 } // namespace onc | 377 } // namespace onc |
| 374 } // namespace chromeos | 378 } // namespace chromeos |
| OLD | NEW |